move access controls to before_filter